Magic Quadrant for Enterprise Governance, Risk …

1 , 12:44 Magic Quadrant for Enterprise governance , Risk and compliance PlatformsСтраница 1 из 16 Quadrant for Enterprise Governance, Risk and compliance Platforms4 October 2012 ID:G00226167 Analyst(s): French Caldwell, John A. WheelerVIEW SUMMARYThe Enterprise governance , risk and compliance platform market has matured to a strategic focus onenterprise risk management. Many vendors are looking toward the next market phase, which includesadding or integrating with business analytics and scorecarding Definition/DescriptionGovernance, risk and compliance (GRC) as a marketplace can be broadly divided between GRCmanagement (GRCM) products for the oversight and operation of risk management and complianceprograms, and other GRC products for the automation and monitoring of controls.

2 For acomprehensive description of the GRC marketplace, see "A Comparison Model for the GRCM arketplace, 2011 to 2013," which addresses the Enterprise GRC (EGRC) platform and its relationshipto other GRCM markets, such as IT GRCM (see "MarketScope for IT governance , Risk and ComplianceManagement"), operational risk management (ORM; see "A Banker's Guide to Credit, Market andOperational Risk Management Software Functionality") and financial governance (see "Q&A: CurrentIssues in Financial governance ").Each of these markets demands some of the functionality that is inherent in the EGRC of acquiring separate solutions for finance, IT and other business units, many enterprises arechoosing to use a single EGRC platform and, when necessary, integrating the many point andfunctional solutions to satisfy specific GRC needs.

3 Reporting and managing through a single platformpotentially give executives, auditors and managers a holistic view of the Enterprise 's risk andcompliance postures, as well as views sorted by requirement, entity and geography. As the EGRC platform market continues to mature, some vendors are seeking to meet these new demands througha single, tightly integrated platform, while others are adopting a plug-and-play strategy, wherecustomers can grow into the solution through the successful implementation of separate, butintegrated primary purpose of the EGRC platform is to automate much of the work associated with thedocumentation and reporting of the risk management and compliance activities that are most closelyassociated with corporate governance and strategic business objectives.

4 The primary end usersinclude internal auditors and the audit committee, risk and compliance managers, legal professionals,and accountable executives. The key functions of importance to these groups are:Risk management: Supports risk management professionals with the documentation,workflow, assessment and analysis, reporting, visualization and remediation of risks . Thiscomponent focuses on general ORM; however, it may collect data from specialized risk analyticstools to provide a consolidated view of ERM. Many industry-specific risk managementrequirements may not be supported. For example, many banks require highly specializedcapabilities for Basel II compliance . Only a few EGRC platform vendors support the ORM needsof banking, and most vendors prefer to integrate the platform with specialized solutions fromother management: Supports internal auditors in managing work papers, and schedulingaudit-related tasks, time management and and policy management: Supports compliance professionals with thedocumentation, workflow, reporting and visualization of controls objectives, controls andassociated risks , surveys and self-assessments, attestation, testing, and remediation.

5 At aminimum, compliance management will include financial reporting compliance (Sarbanes-Oxley[SOX] compliance ), and also support other types of compliance , such as ISO 9000, PaymentCard Industry, industry-specific regulations, SLAs, trading partner requirements and compliancewith internal policies. This function includes a specialized form of document management thatenables the policy life cycle from creation to review, change and archiving of policies; themapping of policies to mandates and business objectives in one direction, and risks and controlsin another; and the distribution to and attestation by employees and business change management: Supports the ability to respond to changes in a rule is changed or a new one emerges, it enables a business impact analysis andsupports the management of the change to related controls, risk assessments and EGRC platform can integrate with business applications, business intelligence (BI), enterpriseEVALUATION CRITERIA DEFINITIONSA bility to ExecuteProduct/Service: Core goods and services offered bythe vendor that competes in/serves the definedmarket.

6 This includes current product/servicecapabilities, quality, feature sets, skills and so on,whether offered natively or through OEMagreements/partnerships, as defined in the marketdefinition and detailed in the Viability (Business Unit, Financial,Strategy, Organization): Viability includes anassessment of the overall organization's financialhealth, the financial and practical success of thebusiness unit, and the likelihood that the individualbusiness unit will continue investing in the product, willcontinue offering the product and will advance thestate of the art within the organization's portfolio Execution/Pricing: The vendor's capabilities inall presales activities and the structure that supportsthem.

7 This includes deal management, pricing andnegotiation, presales support, and the overalleffectiveness of the sales Responsiveness and Track Record: Abilityto respond, change direction, be flexible and achievecompetitive success as opportunities develop,competitors act, customer needs evolve and marketdynamics change. This criterion also considers thevendor's history of Execution: The clarity, quality, creativityand efficacy of programs designed to deliver theorganization's message to influence the market,promote the brand and business, increase awarenessof the products, and establish a positive identificationwith the product/brand and organization in the mindsof buyers. This mind share can be driven by acombination of publicity, promotional initiatives,thought leadership, word-of-mouth and sales Experience: Relationships, products andservices/programs that enable clients to be successfulwith the products evaluated.

8 Specifically, this includesthe ways customers receive technical support oraccount support. This can also include ancillary tools,customer support programs (and the quality thereof),availability of user groups, SLAs and so : The ability of the organization to meet itsgoals and commitments. Factors include the quality ofthe organizational structure, including skills,experiences, programs, systems and other vehiclesthat enable the organization to operate effectively andefficiently on an ongoing of VisionMarket Understanding: Ability of the vendor tounderstand buyers' wants and needs and to translatethose into products and services. Vendors that showthe highest degree of vision listen and understandbuyers' wants and needs, and can shape or enhancethose with their added Strategy: A clear, differentiated set ofmessages consistently communicated throughout theorganization and externalized through the website,advertising, customer programs and Strategy: The strategy for selling products thatuses the appropriate network of direct and indirectsales, marketing, service, and communication affiliatesthat extend the scope and depth of market reach,skills, expertise, technologies, services and , 12.

9 44 Magic Quadrant for Enterprise governance , Risk and compliance PlatformsСтраница 2 из 16 management, controls automation, monitoring solutions (such as segregation of duties), ITtechnical controls (such as server configuration auditing) and continuous control monitoring (CCM) fortransactions. The EGRC platform also integrates with specialized GRCM solutions, such asenvironmental, health and safety (EH&S) compliance , quality management and industry GRC market is eight years old, and all the vendors in the Magic Quadrant have a level offunctionality that will meet the needs of most buyers. Differentiation today is about the ability todeliver advanced risk management functionality, with analysis of the impact of risks on businessperformance, domain expertise in multiple highly regulated industries, and ease of use andconfigurability.

10 In the past, differentiation was about how well the basic core functions of a GRCplatform audit management, compliance management, risk management and policy management were addressed. Because this market is approaching maturity, it is likely that Gartner will producea MarketScope next year, rather than a Magic to TopMagic QuadrantFigure 1. Magic Quadrant for Enterprise governance , Risk and compliance PlatformsSource: Gartner (October 2012)Return to TopVendor Strengths and CautionsBPS ResolverBPS Resolver demonstrated BPS Resolver GRC Cloud , which is most often delivered as softwareas a service (SaaS). With a strong focus on linking risk and performance metrics, BPS Resolver alsodemonstrated good capabilities for audit management, compliance management and riskmanagement.